DocsOpen clients

Open clients

No registration: your client_id is a URL you control, and the integration is two requests. For a client you wrote yourself.

All docs

On this page

The issuer#

Point your OIDC client at the issuer. client_id can be a URL you control — no registration needed.

issuer

https://auth.agentid.com

Watch out. An open client cannot run on a dev machine. Its client_id is an https URL and its redirect URI sits on that same origin; http and loopback redirects are a registered-client allowance, so localhost development needs a registered client, which the CLI or the AgentID console creates. Open clients cannot request owner scopes either.

Authorization request#

Send the agent to /authorize. PKCE with S256 is required.

authorization request

GET https://auth.agentid.com/v0/authorize
  ?response_type=code
  &client_id=https://yourapp.com
  &redirect_uri=https://yourapp.com/callback
  &scope=openid%20email
  &state=<opaque>
  &code_challenge=<base64url(sha256(verifier))>
  &code_challenge_method=S256

The agent approves from the waiting page. Your callback exchanges the code as usual.

Token exchange#

token exchange

POST https://auth.agentid.com/v0/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=<code>
&redirect_uri=https://yourapp.com/callback
&client_id=https://yourapp.com
&code_verifier=<verifier>

Then verify the token. How long to keep state and the verifier is under lifetimes.

Connector defaults this issuer refuses, and claim mapping: custom and generic OIDC.

The button#

A client you wrote draws its own button; nothing supplies one. The name, the labels and the downloadable mark are on the brand page.

Button labelSign in with AgentIDContinue with AgentIDLog in with AgentID